feat: security hardening, tests, doctor command, CI update, CHANGELOG

- Add AES-256-GCM encryption for API keys (internal/secret)
- Add dangerous command detection in terminal
- Add muyue doctor command for system health checks
- Add scanner TTL cache, orchestrator history mutex, shared HTTP client
- Deduplicate MCP config generation, refactor skills YAML parser
- Add XDG-compliant config dir with legacy migration
- Add cleanup on all TUI quit paths
- Add 8 test files (config, workflow, skills, orchestrator, version,
  platform, scanner, secret)
- Update CI to actions/setup-go@v5
- Add CHANGELOG.md, update README and Makefile

🤖 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

cmd/muyue/main.go

@@ -47,6 +47,8 @@ func handleCommand(args []string) {
 		runSetup()
 	case "config":
 		showConfig()
+	case "doctor":
+		runDoctor()
 	case "lsp":
 		runLSP(args[1:])
 	case "mcp":
@@ -76,6 +78,7 @@ Commands:
   update             Check and apply updates for all tools
   setup              Run first-time setup wizard
   config             Show current configuration
+  doctor             Check that everything is properly configured
   lsp [scan|install] Scan or install LSP servers
   mcp [config|scan]  Configure MCP servers for Crush and Claude Code
   skills [list|generate|deploy|init|delete] Manage AI coding skills
@@ -314,6 +317,89 @@ func showConfig() {
 	fmt.Printf("Custom Prompt: %v\n", cfg.Terminal.CustomPrompt)
 }
 
+func runDoctor() {
+	ok := true
+	fmt.Println("Running diagnostics...")
+	fmt.Println()
+
+	fmt.Println("Configuration:")
+	if !config.Exists() {
+		fmt.Println("  [FAIL] Config file not found. Run 'muyue setup' first.")
+		ok = false
+	} else {
+		cfg, err := config.Load()
+		if err != nil {
+			fmt.Printf("  [FAIL] Config load error: %v\n", err)
+			ok = false
+		} else {
+			fmt.Println("  [OK]   Config file present")
+			hasKey := false
+			for _, p := range cfg.AI.Providers {
+				if p.Active && p.APIKey != "" {
+					hasKey = true
+				}
+			}
+			if hasKey {
+				fmt.Println("  [OK]   API key configured")
+			} else {
+				fmt.Println("  [FAIL] No API key set for active provider")
+				ok = false
+			}
+		}
+	}
+
+	fmt.Println("\nTools:")
+	result := scanner.ScanSystem()
+	installed := 0
+	for _, t := range result.Tools {
+		if t.Installed {
+			installed++
+			fmt.Printf("  [OK]   %s\n", t.Name)
+		} else {
+			fmt.Printf("  [FAIL] %s (not installed)\n", t.Name)
+		}
+	}
+	fmt.Printf("  Installed: %d/%d\n", installed, len(result.Tools))
+
+	fmt.Println("\nLSP Servers:")
+	servers := lsp.ScanServers()
+	lspOK := 0
+	for _, s := range servers {
+		if s.Installed {
+			lspOK++
+			fmt.Printf("  [OK]   %s (%s)\n", s.Name, s.Language)
+		}
+	}
+	fmt.Printf("  Available: %d/%d\n", lspOK, len(servers))
+
+	fmt.Println("\nMCP Servers:")
+	mcpServers := mcp.ScanServers()
+	mcpOK := 0
+	for _, s := range mcpServers {
+		if s.Installed {
+			mcpOK++
+		}
+	}
+	fmt.Printf("  Available: %d/%d\n", mcpOK, len(mcpServers))
+
+	fmt.Println("\nSkills:")
+	skillList, err := skills.List()
+	if err != nil || len(skillList) == 0 {
+		fmt.Println("  [FAIL] No skills. Run 'muyue skills init'.")
+		ok = false
+	} else {
+		fmt.Printf("  [OK]   %d skills installed\n", len(skillList))
+	}
+
+	fmt.Println()
+	if ok {
+		fmt.Println("All checks passed!")
+	} else {
+		fmt.Println("Some checks failed. Review the output above.")
+		os.Exit(1)
+	}
+}
+
 func runLSP(args []string) {
 	if len(args) == 0 {
 		args = []string{"scan"}